github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2446] new and unknown programs #1618

New issue

Closed

opened 2026-05-05 08:16:28 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 08:16:28 -06:00

Owner

Originally created by @FOSSONLY on GitHub (Feb 22, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2446

Hello

Is there an way to isolate new/unknown programs automatically, without profile/user interaction with Firejail? I use Firejail already as Login-Shell, but this only works for shell usage, not single binaries for example.

Btw.: Thanks for this great piece of Software

Originally created by @FOSSONLY on GitHub (Feb 22, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2446 Hello Is there an way to isolate new/unknown programs automatically, without profile/user interaction with Firejail? I use Firejail already as Login-Shell, but this only works for shell usage, not single binaries for example. Btw.: Thanks for this great piece of Software

gitea-mirror

2026-05-05 08:16:28 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 08:16:31 -06:00

Author

Owner

@ghost commented on GitHub (Feb 24, 2019):

Not something I have experience with, but there might be useful info in https://github.com/netblue30/firejail/issues/397.

@ghost commented on GitHub (Feb 24, 2019): Not something I have experience with, but there might be useful info in https://github.com/netblue30/firejail/issues/397.

gitea-mirror commented

2026-05-05 08:16:32 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 29, 2019):

The main problem is that it's hard to have a default profile which actually "just works" for most programs and provides meaningful security enhancements. Otherwise, we could just have one profile and use it for all programs (and then it would be a matter of hooking into the package manager or whatever to setup symlinks on package installation).

As of right now, the best we can do is firecfg, but that will only automatically sandbox programs we have profiles for.

The best way to contribute (even if you don't know C!) is to submit more profiles. You can take a look at the ones already in the repos as a guide for creating your own. A great place to get started is looking at #1139 to see which profiles have been requested. The more profiles we have, the greater the coverage of firecfg (loosely speaking) and thus the closer we are to achieving the goal you laid out here :)

@chiraag-nataraj commented on GitHub (May 29, 2019): The main problem is that it's hard to have a default profile which _actually_ "just works" for most programs _and_ provides meaningful security enhancements. Otherwise, we could just have one profile and use it for all programs (and then it would be a matter of hooking into the package manager or whatever to setup symlinks on package installation). As of right now, the best we can do is `firecfg`, but that will only automatically sandbox programs we have profiles for. The best way to contribute (even if you don't know C!) is to submit more profiles. You can take a look at the ones already in the repos as a guide for creating your own. A great place to get started is looking at #1139 to see which profiles have been requested. The more profiles we have, the greater the coverage of `firecfg` (loosely speaking) and thus the closer we are to achieving the goal you laid out here :)

gitea-mirror commented

2026-05-05 08:16:33 -06:00

Author

Owner

@matu3ba commented on GitHub (Jun 21, 2019):

@FOSSONLY Please check the wiki on https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software or give input to discussion at the wiki on #2748, #2749, #2755. Will link suggestion into the wiki discussion.
Guess this can be closed then.

@matu3ba commented on GitHub (Jun 21, 2019): @FOSSONLY Please check the wiki on https://github.com/netblue30/firejail/wiki/Sandboxing-Binary-Software or give input to discussion at the wiki on #2748, #2749, #2755. Will link suggestion into the wiki discussion. Guess this can be closed then.

gitea-mirror commented

2026-05-05 08:16:34 -06:00

Author

Owner

@matu3ba commented on GitHub (Jun 27, 2019):

@chiraag-nataraj Could you change the title to "Automatic isolation of user programs" or "Isolation of user programs without interaction" ?
If this is technical not feasible due to complexity etc, I would suggest to close this.

@matu3ba commented on GitHub (Jun 27, 2019): @chiraag-nataraj Could you change the title to "Automatic isolation of user programs" or "Isolation of user programs without interaction" ? If this is technical not feasible due to complexity etc, I would suggest to close this.

gitea-mirror commented

2026-05-05 08:16:35 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 4, 2019):

@FOSSONLY
I'm closing here due to inactivity, please fell free to reopen if you have more questions.

@rusty-snake commented on GitHub (Sep 4, 2019): @FOSSONLY I'm closing here due to inactivity, please fell free to reopen if you have more questions.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1618

No description provided.

Rows
Columns